I think having SMS codes as a second factor is better than nothing at all. Changes the risk profile significantly. Anybody can try bruteforce your password, but

I think having SMS codes as a second factor is better than nothing at all. Changes the risk profile significantly. Anybody can try bruteforce your password, but a smaller group of people have the ability to intercept your SMS messages.